From: syzbot <syzbot+10a7a8ca6e94600110ec@syzkaller.appspotmail.com>
To: hdanton@sina.com, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] KASAN: use-after-free Read in netdev_core_pick_tx
Date: Thu, 17 Nov 2022 02:53:16 -0800 [thread overview]
Message-ID: <00000000000081d4bc05eda8651b@google.com> (raw)
In-Reply-To: <20221117095316.3682-1-hdanton@sina.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in default_device_exit_batch
device veth1_macvtap left promiscuous mode
device veth0_macvtap left promiscuous mode
device veth1_vlan left promiscuous mode
device veth0_vlan left promiscuous mode
bond6 (unregistering): Released all slaves
------------[ cut here ]------------
WARNING: CPU: 0 PID: 45 at net/core/dev.c:10770 unregister_netdevice_many+0x1421/0x1950
Modules linked in:
CPU: 1 PID: 45 Comm: kworker/u4:2 Not tainted 5.18.0-rc7-syzkaller-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Workqueue: netns cleanup_net
RIP: 0010:unregister_netdevice_many+0x1421/0x1950 net/core/dev.c:10770
Code: 74 08 48 89 df e8 7f 68 ae f9 48 8b 1b 48 89 5c 24 40 4c 39 fb 0f 84 0c 01 00 00 e8 a9 80 5d f9 e9 64 f6 ff ff e8 9f 80 5d f9 <0f> 0b e9 2a ff ff ff e8 93 80 5d f9 0f 0b e9 7a ff ff ff e8 87 80
RSP: 0018:ffffc90000b678e0 EFLAGS: 00010293
RAX: ffffffff88289461 RBX: ffff888016ea00a0 RCX: ffff888017138000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc90000b67a50 R08: ffffffff88289345 R09: fffffbfff1b74a89
R10: fffffbfff1b74a89 R11: 1ffffffff1b74a88 R12: ffff888023fb8e80
R13: 0000000000000002 R14: dffffc0000000000 R15: ffffc90000b67ae0
FS: 0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc044717a70 CR3: 0000000074978000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
default_device_exit_batch+0x660/0x6d0 net/core/dev.c:11241
ops_exit_list net/core/net_namespace.c:167 [inline]
cleanup_net+0x80c/0xc50 net/core/net_namespace.c:594
process_one_work+0x81c/0xd10 kernel/workqueue.c:2289
worker_thread+0xb14/0x1330 kernel/workqueue.c:2436
kthread+0x266/0x300 kernel/kthread.c:376
ret_from_fork+0x1f/0x30
</TASK>
Tested on:
commit: 42226c98 Linux 5.18-rc7
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=16c9e702880000
kernel config: https://syzkaller.appspot.com/x/.config?x=d84df8e1a4c4d5a4
dashboard link: https://syzkaller.appspot.com/bug?extid=10a7a8ca6e94600110ec
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=134b9a95880000
next parent reply other threads:[~2022-11-17 10:54 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20221117095316.3682-1-hdanton@sina.com>
2022-11-17 10:53 ` syzbot [this message]
[not found] <20221116084731.3123-1-hdanton@sina.com>
2022-11-16 16:43 ` [syzbot] KASAN: use-after-free Read in netdev_core_pick_tx syzbot
2022-11-15 17:29 syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=00000000000081d4bc05eda8651b@google.com \
--to=syzbot+10a7a8ca6e94600110ec@syzkaller.appspotmail.com \
--cc=hdanton@sina.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.